Monitoring whether the source is sending logs

Graylog Central (peer support)
1

Hi.
I noticed that some hosts stop sending logs. On sources (Windows), I usually use the nxlog agent. After restarting the nxlog service, everything starts working fine. This does not happen cyclically, but sometimes the problem occurs.
Is it possible to set a notification so that if the source stops sending logs, the administrator will be notified about this fact.

2

You should be able to define an aggregation event, with a condition of count() = 0

https://go2docs.graylog.org/5-2/interacting_with_your_log_data/alerts_and_events.html?Highlight=aggregation

3

yes, but I would have to do it for each stream (I have one or several sources in the stream). I have several dozen streams and I would prefer if it could be dealt with in a general way. For example, I know in advance that there should be 20 sources. Notification should go to the administrator that such a source has not reported

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.